docker-compose.yml

version: "3.4"

services:
  netmaker:
    container_name: netmaker
    image: gravitl/netmaker:v0.17.1
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
    restart: unless-stopped
    volumes:
      - ./data:/root/data
      - dnsconfig:/root/config/dnsconfig
      - mosquitto_data:/etc/netmaker
    networks:
      - traefik
    environment:
      SERVER_NAME: "mq.${NETMAKER_BASE_DOMAIN}"
      SERVER_HOST: "${SERVER_PUBLIC_IP}"
      SERVER_API_CONN_STRING: "nmapi.${NETMAKER_BASE_DOMAIN}:2443"
      COREDNS_ADDR: "${SERVER_PUBLIC_IP}"
      DNS_MODE: "on"
      SERVER_HTTP_HOST: "nmapi.${NETMAKER_BASE_DOMAIN}"
      API_PORT: "8081"
      CLIENT_MODE: "on"
      MASTER_KEY: "${MASTER_KEY}"
      CORS_ALLOWED_ORIGIN: "*"
      DISPLAY_KEYS: "on"
      DATABASE: "sqlite"
      NODE_ID: "netmaker-server-1"
      MQ_HOST: "mq"
      MQ_PORT: "2443"
      MQ_SERVER_PORT: "1883"
      HOST_NETWORK: "off"
      VERBOSITY: "1"
      MANAGE_IPTABLES: "on"
      PORT_FORWARD_SERVICES: ""
      MQ_ADMIN_PASSWORD: "${MQ_ADMIN_PASSWORD}"
    ports:
      - "51821-51830:51821-51830/udp"
    labels:
      - traefik.enable=true
      - traefik.http.routers.netmaker-api.entrypoints=websecure
      - traefik.http.routers.netmaker-api.rule=Host(`nmapi.${NETMAKER_BASE_DOMAIN}`)
      - traefik.http.routers.netmaker-api.service=netmaker-api
      - traefik.http.services.netmaker-api.loadbalancer.server.port=8081
    logging: &logging
      driver: local
      options:
        max-size: 10m
  netmaker-ui:
    container_name: netmaker-ui
    image: gravitl/netmaker-ui:v0.17.1
    depends_on:
      - netmaker
    links:
      - "netmaker:api"
    restart: unless-stopped
    networks:
      - traefik
    environment:
      BACKEND_URL: "https://nmapi.${NETMAKER_BASE_DOMAIN}:2443"
    labels:
      - traefik.enable=true
      # - traefik.http.routers.netmaker-ui-http.entrypoints=web
      - traefik.http.middlewares.nmui-security.headers.accessControlAllowOriginList=*.${NETMAKER_BASE_DOMAIN}
      - traefik.http.middlewares.nmui-security.headers.stsSeconds=31536000
      - traefik.http.middlewares.nmui-security.headers.browserXssFilter=true
      - traefik.http.middlewares.nmui-security.headers.customFrameOptionsValue=SAMEORIGIN
      - traefik.http.middlewares.nmui-security.headers.customResponseHeaders.X-Robots-Tag=none
      - traefik.http.middlewares.nmui-security.headers.customResponseHeaders.Server= # Remove the server name
      - traefik.http.routers.netmaker-ui.entrypoints=websecure
      - traefik.http.routers.netmaker-ui.middlewares=nmui-security@docker
      - traefik.http.routers.netmaker-ui.rule=Host(`nmui.${NETMAKER_BASE_DOMAIN}`)
      - traefik.http.routers.netmaker-ui.service=netmaker-ui
      - traefik.http.services.netmaker-ui.loadbalancer.server.port=80
      # Change sourcerange to your client IP to secure the dashboard during the initial setup
      # - traefik.http.middlewares.secure-ips-nmui.ipwhitelist.sourcerange=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
      # - traefik.http.routers.netmaker-ui.middlewares=secure-ips-nmui@docker
    logging:
      <<: *logging
  traefik:
    image: "traefik:v2.9.6"
    container_name: "traefik"
    command:
      - --log.level=INFO
      - --accesslog=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=traefik
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --certificatesresolvers.myresolver.acme.dnschallenge.provider=duckdns
      - --certificatesresolvers.myresolver.acme.email=${ACME_EMAIL}
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
      - --entrypoints.websecure.address=:2443
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certResolver=myresolver
      - --entrypoints.websecure.http.tls.domains[0].main=${NETMAKER_BASE_DOMAIN}
      - --entrypoints.websecure.http.tls.domains[0].sans=*.${NETMAKER_BASE_DOMAIN}
      - --metrics.prometheus=true
      - --api.dashboard=true
      - --api.insecure=true
      - --api.dashboard=true
      - --serverstransport.insecureskipverify=true
    ports:
      # - "80:80"
      - "2443:2443"
      - "127.0.0.1:2080:8080"
    environment:
      - DUCKDNS_TOKEN=${DUCKDNS_API_TOKEN}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
    # Comment out if you want to serve Traefik's dashboard at traefik.${NETMAKER_BASE_DOMAIN}.
    # labels:
    #   - traefik.enable=true
    #   - traefik.http.routers.traefik-http.entrypoints=websecure
    #   - traefik.http.routers.traefik-http.service=api@internal
    #   - traefik.http.routers.traefik-http.rule=Host(`traefik.${NETMAKER_BASE_DOMAIN}`)
    #   - traefik.http.middlewares.secure-ips.ipwhitelist.sourcerange=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
    #   - traefik.http.routers.traefik-http.middlewares=secure-ips@docker
    #   - traefik.http.services.traefik-containers.loadbalancer.server.port=8080
    networks:
      - traefik
    logging:
      <<: *logging
  coredns:
    container_name: coredns
    image: coredns/coredns
    command: -conf /root/dnsconfig/Corefile
    depends_on:
      - netmaker
    restart: unless-stopped
    volumes:
      - dnsconfig:/root/dnsconfig
    networks:
      - traefik
    logging:
      <<: *logging
  mq:
    container_name: mq
    image: eclipse-mosquitto:2.0.15-openssl
    depends_on:
      - netmaker
    restart: unless-stopped
    command: [ "/mosquitto/config/wait.sh" ]
    environment:
      NETMAKER_SERVER_HOST: "https://nmapi.${NETMAKER_BASE_DOMAIN}:2443"
    volumes:
      - ./config/mosquitto.conf:/mosquitto/config/mosquitto.conf
      - ./config/wait.sh:/mosquitto/config/wait.sh
      - mosquitto_data:/mosquitto/data
      - mosquitto_logs:/mosquitto/log
    networks:
      - traefik
    expose:
      - "8883"
    labels:
      - traefik.enable=true
      - traefik.http.routers.netmaker-broker.rule=Host(`mq.${NETMAKER_BASE_DOMAIN}`)
      - traefik.http.routers.netmaker-broker.entrypoints=websecure
      - traefik.http.routers.netmaker-broker.service=netmaker-broker-svc
      - traefik.http.services.netmaker-broker-svc.loadbalancer.server.port=8883
    logging:
      <<: *logging
  duckdns:
    image: lscr.io/linuxserver/duckdns:version-13f609b7
    container_name: duckdns
    environment:
      - TZ=Europe/London
      - SUBDOMAINS=${DUCKDNS_DOMAINS}
      - TOKEN=${DUCKDNS_API_TOKEN}
      - LOG_FILE=false #optional
    restart: unless-stopped
    logging:
      <<: *logging

volumes:
  dnsconfig: {}
  mosquitto_data: {}
  mosquitto_logs: {}

networks:
  traefik:
    external: true